Skip to content
@apostrophecms vulnerabilities
Newest
-
@apostrophecms import-export, apostrophecms apostrophe +1 more
ApostropheCMS: Unauthenticated resource exhaustion via pre-auth aposBigUpload processing in @apostrophecms/import-export
CVE-2026-113711
Fix available
7.5 High
-
@apostrophecms ai-helper, apostrophecms apostrophe +1 more
ApostropheCMS: Host header controls server-side image fetch origin in @apostrophecms/ai-helper, enabling authenticated SSRF
CVE-2026-113671
Fix available
4.3 Medium
-
@apostrophecms passport-bridge, apostrophecms apostrophe +1 more
ApostropheCMS: Cross-domain session token in URL confers session takeover
CVE-2026-113669
Fix available
5.3 Medium
-
@apostrophecms form, login-hcaptcha, login-recaptcha +1 more +3 more
ApostropheCMS: CAPTCHA response token not URL-encoded
CVE-2026-113667
Fix available
5.3 Medium
-
@apostrophecms db-connect, apostrophecms apostrophe +1 more
ApostropheCMS: Authenticated projection-exclusion prototype-member deletion in @apostrophecms/db-connect causes process-wide denial of service
CVE-2026-113666
Fix available
7.1 High
-
@apostrophecms import-export, apostrophecms apostrophe +1 more
ApostropheCMS import-export tar guard misses './..' because it is a literal '../' substring test
CVE-2026-113664
Fix available
5.3 Medium
-
@apostrophecms import-export, apostrophecms apostrophe +1 more
ApostropheCMS import-export: NoSQL injection via update-key value lets a crafted import match and overwrite an unidentified document
CVE-2026-113662
Fix available
5.4 Medium
-
@apostrophecms form, apostrophecms apostrophe +1 more
ApostropheCMS: Unauthenticated unbounded multipart upload → disk-exhaustion DoS
CVE-2026-113656
Fix available
5.3 Medium
-
@apostrophecms import-export, apostrophecms apostrophe +1 more
ApostropheCMS: Import API bypasses publication roles for protected content
CVE-2026-113649
Fix available
6.5 Medium
-
@apostrophecms import-export, apostrophecms apostrophe +1 more
ApostropheCMS: Missing Authentication in `cleanExport` Route
CVE-2026-113648
Fix available
3.1 Low
-
@apostrophecms mport-export, apostrophecms apostrophe +1 more
ApostropheCMS: Archive duplicate continuation lets contributors overwrite published content
CVE-2026-112956
Fix available
6.5 Medium
-
@apostrophecms import-export, apostrophecms apostrophe +1 more
ApostropheCMS: Import archives can exhaust server storage and deny service
CVE-2026-112955
Fix available
6.5 Medium
-
@apostrophecms import-export, apostrophecms apostrophe +1 more
ApostropheCMS: Exposure of Sensitive Information via predictable export filenames
CVE-2026-112953
Fix available
6.0 Medium